I was looking at the trace of the crash from bug 17600, and it looks like a custom action is calling MsiViewExecute with a null hRec.
I (sadly) don't know much about the wine MSI architecture, but the msiobj_lock on line 484 should fail since rec will never be fetched (null). I think the intention was to make it query->hdr (as it is released later). Sorry if I'm dead wrong - just my 2c
